What is GHSA-5ph8-357j-4hx6?

GHSA-5ph8-357j-4hx6 is a security advisory published by GitHub Security Advisories with Medium severity. FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST ...

Which CVE IDs does GHSA-5ph8-357j-4hx6 cover?

GHSA-5ph8-357j-4hx6 covers the following CVE IDs: CVE-2026-79483. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5ph8-357j-4hx6?

GHSA-5ph8-357j-4hx6 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-5ph8-357j-4hx6MediumCVSS 5.3

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST ...

Vendor

GitHub Security Advisories

Published

August 31, 2026

Last Modified

September 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-79483 →

📋 Description

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-79483
https://github.com/ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection
https://github.com/labring/FastGPT
https://github.com/advisories/GHSA-5ph8-357j-4hx6